Superpatterns

Wow - it's been months since the last OpenSSO tab sweep. Anyway - here's a collection of the latest news from the world of OpenSSO:

• Sun Developer Network continues to publish excellent articles on OpenSSO. Last month, Rick Palkovic of SDN and Francois Lascelles of Layer 7 Techologies collaborated on Delegating XML Gateway Runtime Authorization to OpenSSO, showing how Layer 7's SecureSpan XML Networking Gateway integrates with OpenSSO to provide edge security for SOA, Web 2.0 and cloud-based web services.
• This month, Rick's written another article, this time with Qingwen Cheng and Mrudul Uchil of Sun's OpenSSO engineering team. Enabling IP/Resource/Environment Based Authentication With OpenSSO is a three-part series explaining how this functionality, new in OpenSSO Express Build 8, replaces the pre-existing Gateway servlet to provide a flexible mechanism for including contextual information in the authentication process.
• My colleague, Hubert Le Van Gong has been blogging profusely over the past few weeks on the topic of OpenID 2.0 and OpenSSO. As Hubert mentions, we recently rewrote the OpenSSO OpenID extension to support OpenID 2.0. Hubert's blog entries cover a number of topics specific to the rewrite, including deployment (with an important follow up) and realm/relying party validation. C'est la Vie is definitely a blog worth watching if you're interested in the OpenID/OpenSSO intersection.
• There have been a number of OpenSSO policy agent releases over the past few weeks, including agents for Apache 2.2 and IIS 7. The OpenSSO Policy Agents 3.0 Roadmap is the place to stay up to date.
• The replay of Daniel's OpenSSO webinar from last month, which, by the way, set an internal record for registrations, has been posted online. Click here to catch up.
• Outside Sun, 'Pairg' has released a WordPress plugin for OpenSSO authentication (thanks, Ramoonus, for the tip!). It looks to have much more functionality than the proof of concept code I released a little while ago, so, if you're into WordPress, I recommend you go take a look.

Now I can close a few Firefox tabs and relax. Have a good weekend, everyone!

Encouraged by a comment on my post about the OpenSSO module for Drupal, and the amount of OpenSSO/Drupal buzz on Twitter, I decided to attack WordPress next. Although WordPress has a very different plugin model from Drupal, I was able to reuse much of the code from the Drupal module and get a basic single sign-on plugin working quite quickly. As with the Drupal module, there are certainly bugs in the WordPress plugin - in particular, I just noticed that, if you log in to OpenSSO as a user without a corresponding WordPress account, you can get into a redirect loop if you try to go to a protected page at WordPress.

As usual, there is a README and source code - also available via CVS, and I've added the new provider plugin to the list on the OpenSSO Extensions page.

So... That's two thirds of the Drupal/Joomla/Wordpress CMS trifecta covered... A competent Joomla hacker should be able to take the Drupal/WordPress work and adapt it pretty easily... Anyone want to try while I'm at Catalyst this week?